Last summer, I booked a room at a small hotel/hostel in Lisbon with my wife. The hotel sent us the passcode for the building and for our rooms by sending us links to publicly available websites. The URL ended in "quarto-1" and if you changed the room number in the URL, you could access every single room code.
We complained, got a refund, and they said they would talk to their IT person.
A couple months ago, I noticed the public pages with room codes were still up. I filed complaints with CNPD and ASAE.
I checked again today, and the sites are still up. I'm in the US, but I can access every single room code, building code, and even the Wifi login.
These hotel owners are clearly both incompetent and also don't give too much of a fuck. Is there anything I can do to try to get this fixed? They have a good reputation online, so I don't think most people realize literally anyone off the streets could walk into their room at any time if they wanted to. source